Repository navigation
Conversation
The keys listed were those of Fedora 37 to 40, all past their end of life: ensure_fedora_gpgkey_installed failed on every supported release. Values taken from fedora-gpg-keys-44-2.
rpm 6 sets the version of a gpg-pubkey package to the full fingerprint of the key, where rpm 4 set its short ID: Fedora 44 imports its key as gpg-pubkey-36f612dcf27f7d1a48a835e4dbfcf71c6d9f90a6-6786af3b. Match either.
|
Hi @spnngl. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@spnngl the update looks good, but could you please also add test scenarios? Check out similar rules for rhel to see how it is done. |
From Fedora 45, fedora-gpg-keys installs the keys in /usr/share/pki/rpm-gpg and leaves /etc/pki/rpm-gpg empty, so the remediation of ensure_fedora_gpgkey_installed found no key to import on Fedora 45 and 46. Look in /usr/share/pki/rpm-gpg first and fall back to /etc/pki/rpm-gpg for older releases.
The rule had no test scenarios. Cover: - key_installed: the running release's key is imported. - missing_key: no key is imported. - unsupported_key: only the key of Fedora 40, past its end of life, is imported; the rule accepted it before the release keys were updated.
|
@vojtapolasek Thanks, I added test scenarios in 83037ba: Running them showed that from Fedora 45 the keys are only in |
Description:
products/fedora/product.yml, values fromfedora-gpg-keys-44-2).ensure_fedora_gpgkey_installedmatches thegpg-pubkeypackage version as either the key's short ID (rpm 4) or its full fingerprint in lower case (rpm 6)./usr/share/pki/rpm-gpgfirst, then in/etc/pki/rpm-gpg.key_installed.pass.sh,missing_key.fail.sh,unsupported_key.fail.sh(Fedora 40 key only).Rationale:
gpg-pubkey-36f612dcf27f7d1a48a835e4dbfcf71c6d9f90a6-6786af3b, where rpm 4 names itgpg-pubkey-6d9f90a6-6786af3b. The release, the key's creation time, is the same in both.fedora-gpg-keysinstalls the keys in/usr/share/pki/rpm-gpgand leaves/etc/pki/rpm-gpgempty, so the remediation found no key to import on Fedora 45 and 46.Review Hints:
One commit per change; the first also updates
tests/data/product_stability/fedora.yml.Built with
./build_product fedora --rule-id ensure_fedora_gpgkey_installed. Each scenario ran in a fresh container, withopenscap-scannerandgnupg2installed beforehand: run the scenario, evaluate the rule withoscap xccdf eval, and if it failed, remediate with--remediateand evaluate again:key_installed.passmissing_key.failunsupported_key.failfedora:43fedora:44fedora:45fedora:rawhide(46)Without the
/usr/share/pki/rpm-gpgchange, remediation leaves the rule failing onfedora:rawhide, and the key-importing scenarios can't find their key file.Earlier manual checks of the OVAL change on rpm 4:
fedora:42(rpm 4.20.1) passes with the Fedora 44 key imported and fails with only the Fedora 42 key. Fedora CoreOS 44 passes as shipped (fails with 0.1.82).